The GitLab Features You’re Paying For and (Probably) Not Using
Most organizations running GitLab Premium or Ultimate use a fraction of what they license. While Git hosting, merge requests, and CI/CD, are core features, everything else sits switched off, quietly included in the renewal.
In most cases, implementation projects end when the platform “works,” meaning code pushes and pipelines run. The capabilities that require design decisions, or that belong to security and program management rather than engineering, never get picked up because nobody owned them at rollout.
These GitLab features usually go unused
Security dashboards and vulnerability management. Ultimate customers frequently see scan results only in the merge request widget, one finding at a time. The group-level security dashboard and vulnerability report exist to give security teams a consolidated view across projects, with triage, dismissal, and tracking over time. Teams that skip it end up managing findings in a spreadsheet next to a platform that already does it.
Compliance frameworks. Also Ultimate users. You can define a framework, apply it to projects, and enforce required pipeline configuration and separation of duties automatically. Organizations that assemble audit evidence manually every cycle are usually entitled to this and unaware of it.
Portfolio management. Multi-level epics, roadmaps, and portfolio views ship with Ultimate. Many teams license them and continue planning in a separate tool, which reintroduces the traceability gap they bought GitLab to close.
Merge trains. A Premium feature that verifies merges against the queued result rather than a stale main branch. Teams with high merge volume see broken main branches without it, then blame the tests.
Code Owners. Premium. Approval routed automatically by file path, instead of by whoever remembers who understands that directory.
Geo. Premium disaster recovery through replication. Frequently purchased as part of a bundle, rarely configured, and typically discovered to be unconfigured at the worst possible moment.
Value stream analytics and DORA metrics. Group-level value stream analytics is Premium. Most teams that have it have never opened it. You cannot argue for platform investment without delivery data, and the data is already being collected.
The CI/CD Catalog. Reusable, versioned pipeline components that any project can include. Organizations still copying pipeline YAML between repositories are maintaining by hand something the platform will manage for them, with usage analytics attached.
What to do about it
Run an audit against your license. List the features your tier includes, mark each as in use, deliberately declined, or never evaluated. That third category is usually the largest, and where organizations can find the most value.
Assign an owner to features you want to use. Capabilities spanning security, compliance, and engineering stall when they belong to everyone.
Then be selective. Turning everything on at once produces noise and gets ignored. Pick the two capabilities that address a problem your team is currently solving manually, enable those properly, and move on to the next features.
If you want help auditing your environment against your entitlement, or standing up capabilities you are already paying for, reach out to us.